1

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service.

Is there any reason why a web site (server side, not client side) should not be allowed to consume a 3rd party web service directly, but a separate internal service that makes the call to the 3rd party web service?

Web Site --> 3rd party party web service

or

Web Site --> internal service --> 3rd party web service

4

I am very pleased to have stumbled upon this question as it is a common yet mostly wrongly handled situation.

My answer is there has to be an internal service to serve the purpose of consuming/feeding to a 3rd party service and my rationale is as below.

  1. It helps me track all the occurrences of internal services catering to 3PEs. (assume one day after 1 year you've to find all the 3PEs and you've no clue where they are scattered throughout the code and what their names are, but if you have internal service doing the middlemen work you know exactly what to look for). External association auditing made easy.
  2. If the service gets some issue at the 3rd party end, you've got a possible chance to achieve graceful failures.
  3. You keep track of all the data the 3PEs gonna deliver/consume so you know exactly what comes in and goes out.
  4. In very specific situations these sort of 3PEs need to be done after a Security Architecture review (ex. Banking domain) which involves review of supplier, service, data, privileges, and many more. Having an internal service removes the dependency of 3rd party code being trusted fully. (there is no trust in infosec, right?)

There is a drawback too though. Every time the external service modifies itself, you've to make relevant changes to your internal service accordingly. But that can be tolerated due to the advantages it brings in.

Last point, if you are aiming for PCI-DSS or any other audits you can always add up the report of your 3PEs and the way you handle them using internal services in your secure coding practices evidence list.

Hope this helps.

  • My question was not about general drawbacks, but security relevant concerns. – Rookian Jun 25 '16 at 21:07
  • I see you haven't fully seen the purpose behind the the rationale, lemme add some more light. Unsupervised/ungoverned External code inclusion, uncontrolled/unsupervised data flow, Security requirements from compliance audit perspective and failure to fail gracefully and showing errors on production, Security misconfiguration are the security concerns which Ive covered here. – GhostSpeaks101 Jun 25 '16 at 21:39
3

It can access it directly

There may be reasons why an intermediate internal service may be useful, such as abstracting out the 3rd party web service or providing a common interface to several frontends.

Yet, there's no reason the website couldn't directly consume the third party, if properly done. Note that the website would still need to interface with the internal service, which may be similarly hard as interacting with the third party.

Security-wise, using that internal service may allow you to segregate the third party credentials, or using it for applying another filtering layer to the input, but such service isn't required.

  • Your last point is the most important IMHO. Connecting directly will require to have the credentials all over the place (in each connection code). While using an internal service, it will centralize the credentials to a single point making it easier to monitor and to keep safe. – lepe Jun 24 '16 at 2:01
  • @lepe I would expect a properly coded website not to duplicate configuration parameters like credentials. – Ángel Jun 27 '16 at 23:32
  • I would expect the same. Probably "credentials" is not the best term to use, but maybe "connection". The internal service may centralize all the connections to X server (instead of connecting directly). Perhaps am I misunderstanding the meaning of "internal service"? – lepe Jun 28 '16 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.